f

Author: killagu

lib/core/fetch_factory.js

@@ -2,15 +2,36 @@ const debug = require('util').debuglog('egg:lib:core:httpclient_next');
 
 const mainNodejsVersion = parseInt(process.versions.node.split('.')[0]);
 let FetchFactory;
+let safeFetch;
+let ssrfFetchFactory;
+
 if (mainNodejsVersion >= 18) {
   // urllib@4 only works on Node.js >= 18
   try {
     const urllib4 = require('urllib4');
     FetchFactory = urllib4.FetchFactory;
     debug('urllib4 enable');
+
+    safeFetch = function safeFetch(url, init) {
+      if (!ssrfFetchFactory) {
+        const ssrfConfig = this.config.security.ssrf;
+        const clientOptions = {};
+        if (ssrfConfig?.checkAddress) {
+          clientOptions.checkAddress = ssrfConfig.checkAddress;
+        } else {
+          this.logger.warn('[egg-security] please configure `config.security.ssrf` first');
+        }
+        ssrfFetchFactory = new FetchFactory();
+        ssrfFetchFactory.setClientOptions(clientOptions);
+      }
+      return ssrfFetchFactory.fetch(url, init);
+    };
   } catch (err) {
     debug('require urllib4 error: %s', err);
   }
 }
 
-module.exports = FetchFactory;
+module.exports = {
+  FetchFactory,
+  safeFetch,
+};

lib/egg.js

@@ -14,7 +14,7 @@ const Messenger = require('./core/messenger');
 const DNSCacheHttpClient = require('./core/dnscache_httpclient');
 const HttpClient = require('./core/httpclient');
 const HttpClientNext = require('./core/httpclient_next');
-const FetchFactory = require('./core/fetch_factory');
+const { FetchFactory, safeFetch } = require('./core/fetch_factory');
 const createLoggers = require('./core/logger');
 const Singleton = require('./core/singleton');
 const utils = require('./core/utils');
@@ -56,6 +56,7 @@ class EggApplication extends EggCore {
     if (FetchFactory) {
       this.FetchFactory.setClientOptions();
       this.fetch = FetchFactory.fetch;
+      this.safeFetch = safeFetch.bind(this);
     }
 
     this.loader.loadConfig();

test/lib/core/fetch_factory.test.js

@@ -1,6 +1,6 @@
 const assert = require('node:assert');
 const mm = require('egg-mock');
-const FetchFactory = require('../../../lib/core/fetch_factory');
+const { FetchFactory, safeFetch } = require('../../../lib/core/fetch_factory');
 const utils = require('../../utils');
 
 describe('test/lib/core/fetch_factory.test.js', () => {
@@ -17,4 +17,29 @@ describe('test/lib/core/fetch_factory.test.js', () => {
     const { status } = await FetchFactory.fetch(url);
     assert(status === 200);
   });
+
+  it('should support safeFetch', async () => {
+    let ip;
+    let family;
+    let host;
+    const fetch = safeFetch.bind({
+      config: {
+        security: {
+          ssrf: {
+            checkAddress(aIp, aFamily, aHost) {
+              ip = aIp;
+              family = aFamily;
+              host = aHost;
+              return true;
+            },
+          },
+        },
+      },
+      logger: console,
+    });
+    await fetch(url);
+    assert(ip);
+    assert(family);
+    assert(host);
+  });
 });